Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

mATFWhYtPk.dll

Status: finished
Submission Time: 2021-12-03 00:41:17 +01:00
Malicious
Evader

Comments

Tags

  • 32
  • dll
  • exe
  • trojan

Details

  • Analysis ID:
    533067
  • API (Web) ID:
    900590
  • Analysis Started:
    2021-12-03 00:41:18 +01:00
  • Analysis Finished:
    2021-12-03 00:57:19 +01:00
  • MD5:
    70798426016c93e3d52363c8a902333f
  • SHA1:
    02f29a5c7e7f8230b86d26b36757c1aaa968dde7
  • SHA256:
    5e3bcb83c60c7d06d42822afe1d36c3b0f866ef678935c5903cda936009713a1
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 56
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 17/66

IPs

IP Country Detection
23.211.6.95
 United States

Domains

Name IP Detection
contextual.media.net
 23.211.6.95
hblg.media.net
 23.211.6.95
lg3.media.net
 23.211.6.95
Click to see the 3 hidden entries
assets.msn.com
 0.0.0.0
www.msn.com
 0.0.0.0
browser.events.data.msn.com
 0.0.0.0

URLs

Name Detection
https://www.skype.com/de/download-skype
http://www.twitter.com/
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C117%2C184%2C188%2C203%2C226%2C246%2C2030%2C2033%2C3018&itype=HB-CM&rtime=7479&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usp
Click to see the 97 hidden entries
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
http://www.amazon.com/
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
https://www.msn.com/de-ch/news/other/erste-best%c3%a4tigte-ansteckung-zwei-weitere-verdachtsf%c3%a4l
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
https://onedrive.live.com;OneDrive-App
http://www.hotmail.msn.com/pii/ReadOutlookEmail/
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
https://www.tippsundtricks.co/lifehacks/schwamm-kuhlschrank/?utm_campaign=DECH-schwamm&utm_sourc
https://www.skype.com/de
https://onedrive.live.com/?qt=mru;OneDrive-App
https://msasg.visualstudio.com/Shared%20Data/_git/1DS.JavaScript?version=GBnubenja%2Fcustom-package
https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
https://lg3.media.net/bping.php?&gdpr=0&prid=8PRVV7640&cid=8CU157172&crid=858412214&vi=1638488555656014322&ugd=4&lf=6&cc=CH&sc=ZH&lper=50&wsip=2886781044&r=1638520979551&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&vgd_l2type=setting&vgd_sbSup=0&vgd_is_amp=0&vgd_asn=60068&vgd_rakh=1638488555181756319&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fmedianet.php&vgd_pgid=p11306311666t202112030842&vgd_pgids=1&vgd_gdprcs=1&vgd_uspa=0&hvsid=00001638520979548014104136331645&gdpr=0&vgd_end=1
https://www.linkedin.com:443/news/story/gibt-es-einen-impfstoffmangel-5630362/?li=BBqfZdV
http://ogp.me/ns#
http://www.youtube.com/
https://doceree.com/.well-known/deviceStorage.json
https://smartyads.com/privacy-policy
https://optimise-it.de/datenschutz
https://www.stroeer.de/ssp-datenschutz
https://lg3.media.net/bqi.php?lf=5&&vgd_l2type=setting&pid=8PO8WH2OT&cme=wKMzE5aEf1C7W8c2Zu-wR6W8-LV6OuNn5M8-l7xIv5OFVIrj5gO7h1h0qwkXsk1YkKHiWm6OwnS8YdF7hxOqVy4gI-Di5bXqA_L7Nj1Gg-bLo1QZupPE9_lkGVq8LafeqNrLclh8bDzLkZpLway17PoLJDHoGdSHRiqjLFunN_rSbZHJFAjGFIv7F87z8XmJ-E7BhMXbxjXouwQLvaGa-ShCB3oRwwh8||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|YdjFvixrVaHKWoanJxQ7pN1u-FbdnHzrNjhpugAcObH3UBK3ulwAWl7Dk2fLSIhhcacW0wejpmUUSEEp7HvKRQ==|N7fu2vKt8_s=|2Vo1csK06ElQVm9wtd7kmyhUd8oCSycUmnOt-CKThRGW5B7OtbhnTLfgAjgMfKS9GxuAl0hmLh7h59eRacx_zlI1mhj_yGBtc0wpPjW7ZYHmZRI-Qs46jvsASGwtenQv5_6kd41JpbzUVoJx6JhY_2c-CqKREqoxgJ7iifrLoawE2O9aRy41se9ZHO7dRZ1TuzVy17bY00rUzIYODMSLh1Pcyr8slxcI|&gdpr=0&prid=8PRVV7640&cid=8CU157172&crid=858412214&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&vi=1638488555656014322&ugd=4&cc=CH&sc=ZH&bdrid=4&startTime=1638520979055&l2type=setting&vgd_l1rakh=1638488555181756319&l1ch=1&sttm=1638520979548&upk=1638520976.1854&hvsid=00001638520979548014104136331645&verid=9999999&vgd_sc=ZH&infr=1&twna=1&vgd_hbReqId=T1638483495C8S22U926&l1hcsd=l1!N4|8028&vgd_l1rhst=contextual.media.net&vgd_gdprcs=1&vgd_uspa=0&vgd_isiolc=0&clp=%7B%7D&cl=%7B%7D&rtbsd=10&bidData=sd2%3Dnull~bb%3D186~vv%3D0~erpm%3D0.03~ogerpm%3D0.03~MFB%3D2jo~smm_bid%3D0.02~bm%3D1~smm_sd%3D2021120121~sid%3D858412214~sd%3D1~uid%3D2IaaJtXbXqos4SCzmA~dc2%3D1~btd%3D14241703836931763290446355943300556902506328540099388593272215750316032~scd%3Dzh~uim%3D464908~url_tkc%3D0~ss%3D1280x1024~uiw%3D100~ce%3D1~xgb_sd%3D2021101600~last%3D0~CI%3D2624~ip%3D1xrX0Z~fbb%3D0~riipua%3D0%2C0~xgb_nt%3D101~nts%3D1~tb%3D-1~et%3D27~ct%3Dzurich~rc%3D6%2C0~basis2%3D196~url_b%3D0.03~basis1%3D196~isRef%3D0~lc%3D0~url_tvi%3D0~smm_wr%3D2.2127~url_l%3D50~xgboost_b%3D0.92~bid%3D0.02~xgb_b%3D0.92~dc%3D8~gcat%3D500884~ogbid%3D0.02%7C%7Ccbdp%3D0.02%7C%7Cbflag%3D0%7C%7Csobp%3D0%7C%7Cddiv%3D%25%25DFP_DIV%25%25%7C%7Cdmm%3D%25%25DMS_STRATEGY%25%25%7C%7Cdtc%3Dnydc%7C%7Cabte%3DCONTROL%7C%7Chsw%3D%25%25HAS_SECOND_WINNER%25%25~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D300x250~bsb%3D0~bsp%3D0~tmx%3D200&matchString=hr%3D0&l2ch=1&l2wsip=170721631&sethcsd=set!A18%7C8013&vgd_pgid=p11306311666t202112030842&vgd_pgids=1
https://twitter.com/
https://www.msn.com/de-ch/news/other/kanton-best%c3%a4tigt-ersten-omikron-fall-in-z%c3%bcrich/ar-AAR
https://www.msn.com/de-ch/news/other/kanton-verteidigt-finanzielle-beteiligung-am-kunstprojekt/ar-AA
https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
https://www.tippsundtricks.co/lifehacks/kochendes-wasser-auto/?utm_campaign=DECH-cardent&utm_sou
https://onedrive.live.com/about/en/download/
https://www.bidstack.com/privacy-policy/
http://www.nytimes.com/
https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
https://www.msn.com/de-ch/?ocid=iehp
https://onedrive.live.com/?qt=mru;Aktuelle
https://cdn.cookielaw.org/vendorlist/iabData.json
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
https://outlook.com/
https://cdn.cookielaw.org/vendorlist/googleData.json
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C117%2C184%2C188%2C203%2C226%2C246%2C2030%2C2033%2C3018&itype=HB-CM&rtime=1053&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usp
https://www.botman.ninja/privacy-policy
https://www.stroeer.de/werben-mit-stroeer/onlinewerbung/programmatic-data/sdi-datenschutz-b2c
https://www.msn.com/de-ch/nachrichten/regional
https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
https://www.skype.com/
http://www.reddit.com/
https://www.msn.com/de-ch/news/other/wird-etwas-enger-im-bus-werden-die-kapazit%c3%a4t-aber-stemmen-
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
https://www.queryclick.com/privacy-policy
https://www.msn.com/de-ch/news/other/traurig-und-primitiv-rettungswagen-w%c3%a4hrend-einsatz-verspra
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
https://outlook.live.com/mail/deeplink/compose;Kalender
https://onedrive.live.com/?qt=allmyphotos;Aktuelle
http://ogp.me/ns/fb#
https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
https://www.msn.com/de-ch/sport?ocid=StripeOCID
https://onedrive.live.com;Fotos
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HBI57XIG&region=nv&ptrid=8PR68Q253&requestString=670468743*4%7C300x250%7C8CU157172%7C858412214%7C&crid=670468743&sd=1&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&bl=1&rt=5&dn=https://contextual.media.net&https=1&act=headerBid&prvReqId=655139198087331261638520979902&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.17810036448631755&ndec=1&scrsize=1280x1024&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A284%2C%22vh%22%3A271%2C%22ph%22%3A271%7D&itype=HB-CM&cc=CH&rc=ZH&ct=ZURICH&bt=1&gcp=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
https://www.msn.com/de-ch/news/other/z%c3%bcrich-zahlt-f%c3%bcr-gr%c3%bcne-hausw%c3%a4nde/ar-AARnq3Z
https://www.msn.com/de-ch/nachrichten/coronareisen
https://contextual.media.net/medianet.php?cid=8CU157172
http://searchads.msn.net/.cfm?&&kp=1&
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C117%2C184%2C188%2C203%2C226%2C246%2C2030%2C2033%2C3018&itype=HB-CM&rtime=5&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usp
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C117%2C184%2C188%2C203%2C226%2C246%2C2030%2C2033%2C3018&itype=HB-CM&rtime=6&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usp
https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin
https://clkde.tradedoubler.com/click?p=273363&a=3064090&g=24940322
https://browser.events.data.msn.com/OneCollector/1.0/t.js?qsp=true&anoncknm=%22%22&name=%22MS.News.W
https://silvermob.com/privacy
https://nextmillennium.io/privacy-policy/
https://contextual.media.net/48/nrrV52461.js
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
https://twitter.com/i/notifications;Ich
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
https://www.tippsundtricks.co/gesundheit/stueck-seife-bettwasche/?utm_campaign=DECH-bedsoap&utm_
https://www.msn.com/de-ch
https://assets.msn.com/staticsb/statics/latest/oneTrust/1.2/consent/55a804ab-e5c6-4b97-9319-86263d36
https://contextual.media.net/803288796/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3D%3D&crid=722878611&size=306x271&cc=CH&https=1&vif=2&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&nse=5&vi=1638488555296348136&ugd=4&rtbs=1&nb=1
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
https://www.msn.com/de-ch/news/other/lage-dramatisch-zugespitzt-%c3%b6v-in-winterthur-wird-teilweise
http://crl.ver)
https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
https://www.msn.com/de-ch/
https://secure.adnxs.com/clktrb?id=764680&t=1
https://client-s.gateway.messenger.live.com
https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
https://amzn.to/2TTxhNg
https://www.msn.com/de-ch/news/other/die-provisorische-kantonsschule-auf-dem-irchel-kann-2024-starte

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\17-361657-68ddb2ab[1].js
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARmagQ[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARm1Gs[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
Click to see the 97 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARlmVR[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARlk9e[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARlY5u[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARlOdR[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARlNEA[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARkL8h[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AAMqFmF[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AA6wTdK[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\55a804ab-e5c6-4b97-9319-86263d365d28[2].json
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\4996b9[1].woff
 Web Open Font Format, TrueType, length 45633, version 1.0
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AARmqzU[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\otSDKStub[1].js
 ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\otBannerSdk[1].js
 UTF-8 Unicode text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\nrrV52461[1].js
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\medianet[2].htm
 HTML document, ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\medianet[1].htm
 HTML document, ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\checksync[5].htm
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\checksync[4].htm
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\checksync[3].htm
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\BB7gRE[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\BB1gyTJJ[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARm0KA[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlAXA[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARmger[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARme8P[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARmdP1[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARmbBr[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARm6Wm[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARm3Az[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlvai[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlU0z[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlT6t[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlKcO[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlKWc[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AARlK6L[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARluon[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AAPwrS4[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\AAPFmi4[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\52-478955-68ddb2ab[1].js
 UTF-8 Unicode text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\otPcCenter[1].json
 ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\otFlat[1].json
 ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\otCommonStyles[1].css
 ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\cfdbd9[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\a5ea21[1].ico
 PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\BB6Ma4a[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\BB1gyWh5[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\AAuTnto[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARlAkD[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARfw7b[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AAQCgDb[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AAPXV6f[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AAOdxvW[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AANuZgF[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AA5Wkdg[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\2d-0e97d4-185735b[1].css
 UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat
 data
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARlHk9[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F0A62C50-5414-11EC-90E5-ECF4BB2D2496}.dat
 Composite Document File V2 Document, Cannot read section info
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F0A62C4E-5414-11EC-90E5-ECF4BB2D2496}.dat
 Composite Document File V2 Document, Cannot read section info
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IB42RK38\contextual.media[1].xml
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\EQAWN5DV\www.msn[2].xml
 ASCII text, with no line terminators
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
 data
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
 Extensible storage user DataBase, version 0x620, checksum 0xe2860433, page size 16384, DirtyShutdown, Windows version 10.0
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\de-ch[1].json
 UTF-8 Unicode text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARlt06[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARlMfv[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARlJ4T[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARl0hy[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AARjTo7[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AAQby46[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AAPwesU[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\AAKp8YX[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\otTCF-ie[1].js
 UTF-8 Unicode text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\nrrV52461[1].js
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\iab2Data[1].json
 UTF-8 Unicode text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\e151e5[1].gif
 GIF image data, version 89a, 1 x 1
 #
C:\ProgramData\Microsoft\Network\Downloader\edb.log
 MPEG-4 LOAS
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\checksync[1].htm
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\a8a064[2].gif
 GIF image data, version 89a, 28 x 28
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BBH3Kvo[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BB1kKVy[1].png
 PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BB1ftEY0[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BB1cEP3G[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARmvNW[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARmt9G[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARm6r5[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARm3dD[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\AARlo9i[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
 #